
global _main 

section .data

LC0:
	db "check stack fail!",0ah,0
	
LC1:
	db "%s Error[%d]",0ah,0
	
LC2:
	db "ERROR",0
	
LC3:
	db "OpenProcessToken",0
	
LC4:
	db "LookupPrivilegeValue",0
	
LC5:
	db "AdjustTokenPrivileges",0
	
LC6:
	db "ERROR_NOT_ALL_ASSIGNED",0
	
LC7:
	db "OpenProcess",0
	
LC8:
	db "VirtualAllocEx",0
	
LC9:
	db "WriteProcessMemory",0
	
LC10:
	db "ntdll.dll",0
	
LC11:
	db "LoadLibrary",0
	
LC12:
	db "Kernel32.dll",0
	
LC13:
	db "LoadLibraryA",0
	
LC14:
	db "GetProcAddress_LoadLibraryA",0
	
LC15:
	db "ZwCreateThreadEx",0
	
LC16:
	db "GetProcAddress_ZwCreateThread",0
	
LC17:
	db "SeDebugPrivilege",0
	
LC18:
	db "C:\\Users\\a\\nasm_work\\proj4\\abc.dll",0
	
LC19:
	db "Inject Dll Error.",0ah,0
	
LC20:
	db "Inject Dll OK.",0ah,0

extern _printf,_exit,_memset,_GetLastError,_wsprintfA,_MessageBoxA,_OpenProcessToken,\
_LookupPrivilegeValueA,_AdjustTokenPrivileges,_OpenProcess,_lstrlen,_VirtualAllocEx,\
_WriteProcessMemory,_LoadLibraryA,_GetModuleHandleA,_GetProcAddress,_CloseHandle,\
_FreeLibrary,_GetCurrentProcess

section .text 
_EP_ShowError:
	push ebp
	mov ebp,esp 
	sub esp,0x1000
	
	push ebx
	push esi
	push edi
	
	; [ebp+8] pszText
	
	mov dword [ebp-260], 0 ; szErr
	
	mov esi,esp 
	mov eax,260
	push eax
	mov eax,0
	push eax
	lea eax,[ebp-260] ; szErr
	push eax
	call _memset 
	add esp,12
	cmp esi,esp
	call _cs 
	
	call _GetLastError 
	mov esi,esp 
	push eax
	mov eax,[ebp+8] ; pszText
	push eax
	push LC1
	lea eax,[ebp-260] ; szErr
	push eax 
	call _wsprintfA
	add esp,16
	cmp esi,esp 
	call _cs 

	mov esi,esp 
	push 0
	push LC2
	lea eax,[ebp-260] ; szErr
	push eax
	push 0
	call _MessageBoxA 
	cmp esi,esp 
	call _cs 
		
	mov eax,0
	pop edi
	pop esi 
	pop ebx 
	add esp,0x1000 
	leave
	ret 
	
_EnablePrivileges:
	push ebp
	mov ebp,esp 
	sub esp,0x1000
	
	push ebx
	push esi
	push edi 
		
	; [ebp+8] hProcess 
	; [ebp+12] pszPrivilegesName 
	mov dword [ebp-4], 0 ; hToken 
	mov dword [ebp-12], 0 ; luidValue 
	mov dword [ebp-28], 0 ; tokenPrivileges
	mov dword [ebp-32], 0 ; bRet
	mov dword [ebp-36], 0 ; dwRet 
	
	mov esi,esp 
	lea eax,[ebp-4] ; hToken
	push eax 
	push 32
	mov eax,[ebp+8] ; hProcess
	push eax 
	call _OpenProcessToken 
	cmp esi,esp 
	call _cs 
	
	mov [ebp-32],eax ; bRet
	
	cmp dword [ebp-32], 0 ; bRet
	jne .LEnablePrivileges_400
	
	mov esi,esp 
	push LC3
	call _EP_ShowError
	add esp,4
	cmp esi,esp 
	call _cs  
	
	mov eax,0
	jmp .LEnablePrivileges_0
	
.LEnablePrivileges_400:

	mov esi,esp
	lea eax,[ebp-12] ; luidValue
	push eax
	mov eax,[ebp+12] ; pszPrivilegesName 
	push eax
	push 0
	call _LookupPrivilegeValueA
	cmp esi,esp
	call _cs
	
	mov [ebp-32], eax ;bRet
	
	cmp dword [ebp-32], 0 ;bRet
	jne .LEnablePrivileges_390
	
	mov esi,esp
	push LC4
	call _EP_ShowError
	add esp,4
	cmp esi,esp
	call _cs

	mov eax,0
	jmp .LEnablePrivileges_0
	
.LEnablePrivileges_390:
	lea edi,[ebp-28] ; tokenPrivileges
	mov dword [edi], 1 ; tokenPrivileges.PrivilegeCount
	
	mov eax,0 
	imul eax,12
	lea edi,[ebp-28] ; tokenPrivileges
	lea edi,[edi+4] ; tokenPrivileges.Privileges
	lea edi,[edi+eax] ; tokenPrivileges.Privileges[0]
	mov eax,[ebp-12] ; luidValue
	mov [edi],eax ; Luid
	mov dword [edi+8],2 ; Attributes
	
	mov esi,esp 
	push 0
	push 0
	push 0
	lea eax,[ebp-28] ; tokenPrivileges
	push eax
	push 0 
	mov eax,[ebp-4] ; hToken
	push eax
	call _AdjustTokenPrivileges 
	cmp esi,esp 
	call _cs 
	
	mov [ebp-32],eax ;bRet
	
	cmp dword [ebp-32], 0 ;bRet
	jne .LEnablePrivileges_380
	
	mov esi,esp 
	push LC5
	call _EP_ShowError
	add esp,4
	cmp esi,esp 
	call _cs 
	
	mov eax,0 
	jmp .LEnablePrivileges_0
	
.LEnablePrivileges_380:
	call _GetLastError
	mov dword [ebp-36],eax ; dwRet
	
	cmp dword [ebp-36], 0 ; dwRet
	jne .LEnablePrivileges_370
	
	mov eax,1
	jmp .LEnablePrivileges_0
	
.LEnablePrivileges_370:
	cmp dword [ebp-36], 1300 ; dwRet
	jne .LEnablePrivileges_1

	mov esi,esp 
	push LC6
	call _EP_ShowError
	add esp,4
	cmp esi,esp 
	call _cs 
	
	mov eax,0
	jmp .LEnablePrivileges_0	
	
.LEnablePrivileges_1:
	mov eax,0
.LEnablePrivileges_0:
	pop edi
	pop esi
	pop ebx 
	add esp,0x1000 
	leave
	ret 
	
	
_cs:
	je .Lcs_0
	
	push LC0 
	mov eax,0 
	call _printf 
		
	push 0 
	call _exit 
.Lcs_0:
	ret 
	
_ZwCreateThreadExInjectDll:
	push ebp
	mov ebp,esp 
	sub esp,0x1000
	
	push ebx
	push esi
	push edi
	
	; [ebp+8] dwProcessId
	; [ebp+12] pszDllFileName
	
	mov dword [ebp-4], 0 ; hProcess
	mov dword [ebp-8],0 ; dwSize 
	mov dword [ebp-12],0 ; pDllAddr
	mov dword [ebp-16],0 ; pFuncProcAddr
	mov dword [ebp-20],0 ; hRemoteThread
	mov dword [ebp-24],0 ; dwStatus
	mov dword [ebp-28],0 ; hNtdllDll
	mov dword [ebp-32],0 ; ZwCreateThreadEx
	
	mov esi,esp 
	mov eax,[ebp+8] ; dwProcessId
	push eax
	push 0 
	push 2097151
	call _OpenProcess 
	cmp esi,esp 
	call _cs 
	
	mov [ebp-4], eax ; hProcess
	
	cmp dword [ebp-4], 0 ; hProcess
	jne .LZwCreateThreadExInjectDll_400
	
	mov esi,esp 
	push LC7 
	call _EP_ShowError
	add esp,4
	cmp esi,esp 
	call _cs 
	
	mov eax,0
	jmp .LZwCreateThreadExInjectDll_0
	
.LZwCreateThreadExInjectDll_400:
	mov esi,esp 
	mov eax,[ebp+12] ; pszDllFileName
	push eax 
	call _lstrlen 	
	cmp esi,esp 
	call _cs 
	add eax,1
	mov [ebp-8], eax ; dwSize
	
	mov esi,esp 
	push 4
	push 4096
	mov eax,[ebp-8] ; dwSize
	push eax 
	push 0
	mov eax,[ebp-4] ; hProcess
	push eax 
	call _VirtualAllocEx 
	cmp esi,esp 
	call _cs

	mov [ebp-12], eax ; pDllAddr
	
	cmp dword [ebp-12], 0
	jne .LZwCreateThreadExInjectDll_390
	
	mov esi,esp 
	push LC8 
	call _EP_ShowError
	add esp,4
	cmp esi,esp 
	call _cs 
	
	mov eax,0
	jmp .LZwCreateThreadExInjectDll_0
	
.LZwCreateThreadExInjectDll_390:

	mov esi,esp 
	push 0
	mov eax,[ebp-8] ; dwSize
	push eax
	mov eax,[ebp+12] ; pszDllFileName
	push eax
	mov eax,[ebp-12] ; pDllAddr
	push eax
	mov eax,[ebp-4] ; hProcess
	push eax
	call _WriteProcessMemory 
	cmp esi,esp 
	call _cs 
	
	cmp eax, 0 
	jne .LZwCreateThreadExInjectDll_380
	
	mov esi,esp 
	push LC9
	call _EP_ShowError
	add esp,4
	cmp esi,esp 
	call _cs 
	
	mov eax,0
	jmp .LZwCreateThreadExInjectDll_0
	
.LZwCreateThreadExInjectDll_380:
	mov esi,esp 
	push LC10 
	call _LoadLibraryA
	cmp esi,esp 
	call _cs
	mov [ebp-28], eax ; hNtdllDll
	
	cmp dword [ebp-28], 0 ; hNtdllDll
	jne .LZwCreateThreadExInjectDll_370
	
	mov esi,esp 
	push LC11 
	call _EP_ShowError
	add esp,4
	cmp esi,esp
	call _cs 
	
	mov eax,0
	jmp .LZwCreateThreadExInjectDll_0
	
.LZwCreateThreadExInjectDll_370:

	mov esi,esp 
	push LC12 
	call _GetModuleHandleA
	cmp esi,esp 
	call _cs 	

	mov esi,esp 
	push LC13
	push eax 
	call _GetProcAddress 
	cmp esi,esp 
	call _cs 
	
	mov [ebp-16], eax ; pFuncProcAddr
	
	cmp dword [ebp-16], 0 ; pFuncProcAddr
	jne .LZwCreateThreadExInjectDll_360
	
	mov esi,esp 
	push LC14 
	call _EP_ShowError
	add esp,4
	cmp esi,esp 
	call _cs 
	
	mov eax,0
	jmp .LZwCreateThreadExInjectDll_0
	
.LZwCreateThreadExInjectDll_360:
	
	mov esi,esp 
	push LC15 
	mov eax,[ebp-28] ; hNtdllDll
	push eax
	call _GetProcAddress
	cmp esi,esp 
	call _cs 
	
	mov [ebp-32], eax ; ZwCreateThreadEx
	
	cmp dword [ebp-32], 0 ; ZwCreateThreadEx
	jne .LZwCreateThreadExInjectDll_350
	
	mov esi,esp 
	push LC16
	call _EP_ShowError
	add esp,4
	cmp esi,esp 
	call _cs 
	
	mov eax,0
	jmp .LZwCreateThreadExInjectDll_0
	
.LZwCreateThreadExInjectDll_350:
	mov esi,esp 
	push 0
	push 0
	push 0
	push 0
	push 0
	mov eax,[ebp-12] ; pDllAddr
	push eax
	mov eax,[ebp-16] ; pFuncProcAddr
	push eax
	mov eax,[ebp-4] ; hProcess
	push eax
	push 0
	push 2097151
	lea eax,[ebp-20] ; hRemoteThread
	push eax
	mov eax,[ebp-32] ; ZwCreateThreadEx
	call eax 
	cmp esi,esp 
	call _cs 
	mov [ebp-24], eax ; dwStatus
		
	cmp dword [ebp-20], 0 ; hRemoteThread
	jne .LZwCreateThreadExInjectDll_340
	
	mov esi,esp 
	push LC15 
	call _EP_ShowError
	add esp,4
	cmp esi,esp 
	call _cs 
	
	mov eax,0
	jmp .LZwCreateThreadExInjectDll_0
	
.LZwCreateThreadExInjectDll_340:
	mov esi,esp 
	mov eax,[ebp-4] ; hProcess
	push eax 
	call _CloseHandle 
	cmp esi,esp 
	call _cs 
	
	mov esi,esp 
	mov eax,[ebp-28] ; hNtdllDll
	push eax 
	call _FreeLibrary 
	cmp esi,esp 
	call _cs 
	
	mov eax,1
.LZwCreateThreadExInjectDll_0:
	pop edi
	pop esi
	pop ebx 
	add esp,0x1000
	leave
	ret
	
	
_main:
	push ebp
	mov ebp,esp 
	sub esp,0x1000
	
	mov dword [ebp-4], 0 ; bRet
	
	call _GetCurrentProcess 
	
	mov esi,esp 
	push LC17 
	push eax
	call _EnablePrivileges
	add esp,8
	cmp esi,esp 
	call _cs 
	
	mov esi,esp 
	push LC18 
	push 1084
	call _ZwCreateThreadExInjectDll
	add esp,8
	cmp esi,esp 
	call _cs 
	
	mov [ebp-4], eax ; bRet
	
	cmp dword [ebp-4], 0 ; bRet
	jne .Lmain_10
	
	mov esi,esp 
	push LC19 
	call _printf
	add esp,4
	cmp esi,esp 
	call _cs 
	jmp .Lmain_0

.Lmain_10:	
	mov esi,esp 
	push LC20 
	call _printf 
	add esp,4
	cmp esi,esp 
	call _cs 

.Lmain_0:
	mov eax,0
	leave
	ret 